Securing IoT-Enabled Medical Devices: 5 Essential Tips

Part of our Bluetooth Low Energy security series for medical devices. For the full overview, start with BLE and Medical Device Cybersecurity.

Updated November 16, 2024

Rapid advances in technology have changed healthcare. The Internet of Things (IoT) helps improve patient care and streamline medical processes. But as IoT-enabled medical devices spread, so does the need for stronger security. This article covers the value of IoT in healthcare, the risks and challenges tied to IoT devices, and five practical ways to secure them.

Key Takeaways

• Implement security frameworks aligned with industry standards.
• Apply software updates and patches promptly.
• Use strong multi-factor authentication for access control.
• Ensure all patient data is encrypted in transit and at rest.
• Conduct frequent security audits and vulnerability assessments.
• Leverage AI/ML for real-time threat detection and response.

Table of Contents

• Key Takeaways
• Understanding the Importance of IoT in Healthcare
• The Need for Security in IoT-Enabled Medical Devices
• Essential Tips for Securing IoT-Enabled Medical Devices
• Future of IoT Security in Healthcare
• Medical Device Cybersecurity FAQs

Why this matters

The security of IoT-enabled medical devices directly impacts patient safety, data privacy, and the operational integrity of healthcare systems. A compromised device can lead to unauthorized access to sensitive patient health information (PHI), device malfunction, or even cessation of critical care, posing severe risks to patient well-being.

The FDA's 'Cybersecurity in Medical Devices' Final Guidance, dated February 3, 2026, emphasizes the necessity of robust cybersecurity practices throughout a device's total product lifecycle. This guidance highlights the imperative for manufacturers and healthcare providers to implement controls aligned with recognized standards. Relevant standards include IEC 80001-1 (Application of risk management for IT networks in healthcare), ISO 27001 (Information security management systems), and AAMI TIR57 (Principles for medical device security, Risk management).

Failure to adequately secure these devices not only jeopardizes patient outcomes but also exposes organizations to significant financial penalties, legal liabilities, and reputational damage. Proactive cybersecurity protects against evolving threats and ensures the continuity of care.

Understanding the Importance of IoT in Healthcare

The integration of Internet of Things (IoT) technology in healthcare has changed patient monitoring, diagnostics, and treatment. IoT devices, such as wearable sensors and remote monitoring systems, let healthcare professionals gather real-time patient data, track vital signs, and even deliver personalized care from a distance. This technology has been especially useful for managing chronic conditions and enabling rapid response to emergencies.

One example is the development of IoT-enabled devices by Philips Healthcare. These devices monitor patients with chronic illnesses and send data to healthcare providers for remote analysis. That allows doctors to intervene quickly when needed, saving lives and reducing hospital readmissions.

IoT in modern medicine goes beyond patient care. IoT-enabled medical devices also change how medical systems operate. They can automate inventory management, streamline workflows, and track equipment maintenance. That improves efficiency, reduces costs, and improves patient experience.

A good example is the smart infusion pumps produced by companies like Becton Dickinson and Company (BD). These devices monitor medication administration to ensure accurate dosing and use IoT functions to help staff track and manage drug inventory. That helps prevent shortages and improves patient safety.

The Future Possibilities of IoT in Healthcare

As IoT keeps advancing, its healthcare use cases will grow. One promising area is telemedicine. Remote monitoring and personalized care can help close the gap between patients and providers, especially in rural or underserved areas.

IoT can also support preventive healthcare. By continuously monitoring vital signs and collecting lifestyle data, IoT devices can help people make better health decisions and help clinicians spot early warning signs of potential problems.

Risks and Challenges of IoT in Healthcare

The benefits of IoT in healthcare are clear, but the rapid growth of connected devices also creates serious risks. These devices are attractive targets for cybercriminals looking to exploit weaknesses. A successful attack can compromise patient privacy, disrupt critical medical services, and put lives at risk.

Recent incidents have exposed these weaknesses. I n 2015, hackers gained access to a prominent hospital’s network, taking control of its IoT-enabled drug infusion pumps. That incident made the need for stronger security impossible to ignore.

Integrating IoT devices into existing healthcare systems is also difficult. Interoperability, data privacy, and regulatory compliance remain ongoing concerns that must be addressed if healthcare is going to get the full value from IoT.

The Need for Security in IoT-Enabled Medical Devices

Securing IoT-enabled medical devices is necessary to protect patient data, preserve the integrity of medical procedures, and keep care running. These devices need protection from unauthorized access, malware, and data breaches. They also need protection against physical tampering, because compromised functionality can have serious consequences.

Securing these devices takes more than one control. It requires strong encryption, secure communication protocols, strict access controls, continuous monitoring, and timely software updates to address new threats.

The Vulnerability of IoT Medical Devices

IoT medical devices are vulnerable for several reasons. First, many run outdated or unpatched software, which exposes known weaknesses. Manufacturers need to prioritize regular updates to reduce that risk.

Second, the number of devices and the complexity of their interconnected networks create many entry points for attackers. Each device can become the weak link. One compromised device can have broad impact. Network segmentation and access controls are essential to reduce unauthorized access.

For example, in 2017, the United States Food and Drug Administration (FDA) issued a cybersecurity alert concerning a specific type of implantable cardiac pacemaker due to cybersecurity vulnerabilities. If exploited, those vulnerabilities could let an attacker manipulate the device’s functionality and endanger the patient’s life.

To address these risks, manufacturers and healthcare providers need to work closely with cybersecurity experts to identify threats, assess risk, and implement effective security measures. That helps ensure devices are designed with security in mind and that healthcare teams know how to reduce risk in practice.

Potential Consequences of Unsecured Devices

The consequences of unsecured IoT medical devices go beyond immediate patient safety risks. Data breaches can expose sensitive patient information and lead to identity theft and fraud. Unauthorized access to medical devices can disrupt critical healthcare services, delay treatment, and affect medical research.

For instance, in 2019, a large-scale data breach affected Quest Diagnostics, a prominent medical laboratory company. The breach exposed the personal information of nearly 12 million patients, showing how large the impact can be on patients and healthcare organizations. It led to financial losses, damaged trust, and harmed the company’s reputation.

Unsecured IoT medical devices can also become part of botnets, networks of compromised devices controlled by malicious actors. Those botnets can launch large-scale distributed denial-of-service (DDoS) attacks, overwhelming critical healthcare infrastructure and disrupting essential services.

Healthcare organizations need to reduce these risks with regular security audits, employee training, incident response plans, and continuous monitoring and updates.

Essential Tips for Securing IoT-Enabled Medical Devices

1. Establishing a Robust Security Framework

Healthcare organizations need security frameworks that cover all aspects of IoT device security. That includes access controls, network segmentation, regular vulnerability assessments, and incident response plans. These frameworks should align with industry best practices and regulatory requirements.

Healthcare organizations can also consider advanced threat detection systems that use machine learning to identify and respond to threats in real time. These systems can analyze network traffic patterns, device behavior, and user activity to detect anomalies that may indicate a breach.

2. Regular Software Updates and Patches

Manufacturers need to build secure software and release updates quickly when vulnerabilities are found. Healthcare organizations need to make sure deployed devices receive those updates and patches on time. Regular updates fix newly discovered flaws and improve the overall security posture of IoT devices.

One example of proactive updates is Apple’s iOS, which powers the Apple Watch, among other devices. Apple regularly releases software updates, including security patches, to address emerging threats and keep devices resistant to cyberattacks.

Healthcare organizations can also build partnerships with software vendors and device manufacturers to receive timely notice of security updates and patches. That helps providers stay aware of new vulnerabilities and respond quickly.

3. Implementing Strong Authentication Measures

Only authorized personnel should be able to access and interact with IoT medical devices. Strong multi-factor authentication measures, such as biometric verification and cryptography, should be used to prevent unauthorized access. Each user should have an individual account with unique credentials for accountability and tighter access control.

Healthcare organizations can also use advanced user behavior analytics (UBA) systems. These systems analyze user activity patterns and detect suspicious behavior that may indicate a compromised account. Continuous monitoring helps identify threats and stop unauthorized access quickly.

4. Ensuring Data Encryption

Encrypting data at rest and in transit is essential to protect sensitive patient information from unauthorized disclosure and tampering. Strong encryption algorithms and protocols should be used to secure data generated, transmitted, and stored by IoT medical devices. That includes data stored on device memory, sent across networks, and exchanged with backend systems.

Healthcare organizations can also use data loss prevention (DLP) systems. These systems monitor data flows and help prevent leaks or unauthorized access. With clear policies and rules for data use and access, DLP systems help providers maintain control over IoT-enabled medical device data.

5. Conducting Regular Security Audits

Healthcare organizations should conduct regular security audits of their IoT medical devices to maintain security and catch new vulnerabilities. These audits should review device configurations, network infrastructure, and security controls to identify weaknesses. The results should drive security improvements and support compliance with relevant regulations and industry standards.

Healthcare organizations can also establish bug bounty programs. These programs reward ethical hackers for finding and reporting vulnerabilities in IoT medical devices. That gives providers access to outside expertise and helps them address threats before attackers do.

Future of IoT Security in Healthcare

Emerging Trends in IoT Security

Advances in artificial intelligence (AI) and machine learning (ML) are changing IoT security. These technologies can detect unusual behavior in IoT networks, identify threats, and respond in real time. AI-powered systems support proactive monitoring and better threat intelligence.

Blockchain technology is also gaining traction as a secure and decentralized approach to IoT security. Healthcare organizations can use blockchain’s immutable and transparent structure to improve IoT data integrity, secure device communication, and strengthen access controls. For example, a blockchain-based healthcare network can verify medical devices’ authenticity and secure patient data exchange.

The Role of AI and Machine Learning in IoT Security

AI and ML algorithms are increasingly used to detect and mitigate cybersecurity threats in IoT devices. These algorithms can analyze large volumes of data in real time and identify patterns that suggest a security breach. That helps healthcare organizations detect and respond to threats faster, reduce the chance of successful attacks, and protect the integrity of IoT-enabled medical devices.

Regulatory Measures for IoT Security in Healthcare

Regulators are paying closer attention to IoT security in healthcare. Governments and industry groups around the world are issuing guidelines and standards for medical device security to protect patients and data. Compliance is becoming a baseline requirement for manufacturers and healthcare providers.

The EU has taken a major step with the Medical Device Regulation (MDR). The MDR sets strict criteria for cybersecurity and data protection in medical devices, raising the security bar across the EU healthcare system.

Conclusion

IoT devices bring real benefits to healthcare, but they also introduce real security risks. To secure IoT-enabled medical devices, healthcare organizations and manufacturers need to build strong security frameworks, keep software updated, use strong authentication, encrypt data, and run regular security audits. AI, ML, and blockchain may improve IoT security further. Regulations such as the MDR will also keep shaping how patient safety and data privacy are protected.

Blue Goat Cyber provides B2B cybersecurity services focused on medical device security. The team handles penetration testing, HIPAA and FDA compliance, SOC 2 Penetration testing, and PCI penetration testing, among other services. Contact us today for cybersecurity help.

Check out our full-service FDA cybersecurity submission package.

How Blue Goat approaches this

Blue Goat Cyber applies a methodical approach to securing IoT devices, integrating security into every phase of the device lifecycle. Our method includes thorough threat modeling, risk assessments, and vulnerability testing specific to IoT medical devices. We help organizations meet regulatory expectations by aligning security measures with FDA guidance and industry standards.

Our team, comprising certified professionals (CISSP, OSCP) with ex-military red team experience, delivers practical security solutions. We conduct penetration testing and design security architectures that address the unique challenges of connected medical technology.

Learn more about our services, including medical device penetration testing, which helps uncover vulnerabilities before they can be exploited. If the FDA raises cybersecurity deficiencies after our submission, we resolve them at no additional cost.

Medical Device Cybersecurity FAQs

How do I get a quote for a medical device test from Blue Goat?

Please schedule a 30-minute Discovery Session with us so we can best understand your objectives.

What insights does Blue Goat Cyber provide related to software testing in the healthcare industry?

Blue Goat Cyber provides several key insights related to software testing in the healthcare industry, focusing on comprehensive methods for various software and medical devices. They emphasize the importance of governance in cybersecurity programs, ensuring that medical software complies with regulatory standards like FDA guidelines and HIPAA. Additionally, Blue Goat Cyber stresses proactive risk mitigation, including strategies for identifying and managing potential vulnerabilities in healthcare software. Their approach also includes educating healthcare organizations on cybersecurity risks and best practices, advocating for a culture of awareness and proactive security measures in the industry.

What are the security requirements that medical device applicants must now meet?

The FDA has established specific cybersecurity requirements that medical device manufacturers must meet. These include:

1. Secure Product Development Lifecycle: Manufacturers are required to implement a secure product development lifecycle. This involves reducing the number and severity of vulnerabilities throughout the entire lifecycle of their devices, from design and development to distribution, deployment, and maintenance.

2. Threat Modeling and Post-Market Vulnerability Management: Manufacturers must conduct threat modeling and outline plans for addressing post-market vulnerabilities. This includes patching and software updates to respond to potential security issues.

3. Coordinated Disclosure of Exploits and Software Bill of Materials: Details of the methods for coordinated disclosure of exploits must be included. Manufacturers must also supply a software bill of materials (SBOM) that details all third-party commercial, open-source, and off-the-shelf software components used in their devices.

4. Process and Procedures for Postmarket Updates and Patches: Companies must provide details on the processes and procedures for releasing postmarket updates and patches that address security issues. This includes regular updates and out-of-band patches for critical vulnerabilities.

These requirements apply to "cyber devices," which are defined as any devices that run software, have the ability to connect to the internet, and could be vulnerable to cyber threats. As of October 1, 2023, the FDA's refuse-to-accept policy comes into force for pre-market submissions that lack the required cybersecurity information.

Medical device manufacturers should familiarize themselves with the FDA's updated guidance document, "Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions," to ensure their products meet the required cybersecurity standards. Failure to meet these requirements could result in the FDA rejecting pre-market submissions.

What new policy has the FDA announced for medical device manufacturers?

According to the recent announcement by the FDA, medical device manufacturers are now required to adhere to a new policy related to cybersecurity. Under this policy, all new applicants for medical devices must submit a comprehensive plan that outlines how they will actively monitor, identify, and address potential cybersecurity issues. This plan should also include steps to ensure that the device in question is adequately protected.

Additionally, the FDA now mandates that applicants establish a reliable process that reasonably assures the device's security. This includes taking necessary measures to make security updates and patches available regularly and in critical situations. The applicants must also provide the FDA with a detailed software bill of materials, encompassing any open-source or other software utilized in their devices.

Overall, this new policy enacted by the FDA emphasizes the importance of cybersecurity in medical devices and aims to ensure that manufacturers take appropriate measures to safeguard patient safety and protect against potential cyber threats.

What is Blue Goat's methodology for medical device cybersecurity assessment for FDA compliance?

Blue Goat uses a two-step Assessment Evolution test/retest approach for optimal outcomes. Within each Evolution, in addition to the actual medical device assessment and testing components, we dedicate access to our cybersecurity team for report clarification and knowledge exchange, assisting in your understanding of the test findings and the remediation strategies.

Post-remediation of Evolution 1, we will again conduct the cybersecurity assessment and penetration test to assess the efficacy of addressing identified vulnerabilities. This second set of reporting demonstrates a stronger security posture and, therefore, a more impactful Letter of Attestation.

Our overall medical device security assessment and testing process involves four high-level phases:

1. Discovery
2. Security Boundary Definition
3. Security Risk Assessment
4. Mitigation Strategy

Medical Device Assessment Evolution 1

1. Preparation (Offsite). Before we travel to your facility, we prepare for the onsite visit. Our preparation consists of Discovery, such as a review of the following:

• Design documents
• Data flow diagrams
• Use cases
• Traceability matrix
• Security architecture
• User manuals
• Admin/maintenance manuals
• Installation procedures and guidance
• Risk assessment
• Hazard analysis
• Source code
• Total Product Life Cycle (TPLC) documentation
• Product photos
• Any other relevant device documentation

We intend to get familiar with your product, formulate a plan of action, and develop the Test Plan and Test Cass before our onsite visit. This allows us to optimize our time onsite.

2. T esting (Onsite or at Blue Goat's facility). We travel to your facility to perform the cybersecurity assessment and penetration test against your medical device/system. Testing can also be performed at Blue Goat’s facility if you ship the equipment to us. Our testing consists of identifying all entry points into the system, such as Ethernet, Fiber, WiFi, USB, BTLE, Serial, and HDMI. We assess vulnerabilities associated with each entry point and the exploitation of initial and subsequent vulnerabilities. Any critical findings discovered will immediately be brought to your attention. In addition, due to the nature of our engagement, we can share our test results with you daily as an end-of-day update.

3. Reporting (Offsite). At the end of testing, we generate a medical device cybersecurity assessment and penetration test report that ranks our findings based on criticality. The report will include step-by-step exploitation steps, described with screenshots. The report also includes remediation guidance for each finding.

4. Report Presentation (Offsite). Once the report is completed, we securely send it to you and review it via Zoom.

Between Evolution 1 and Evolution 2, you will work on fixing issues identified in Evolution 1.

Medical Device Assessment Evolution 2

When you are ready for us to retest the medical device, we repeat the applicable steps of Evolution 1 in Evolution 2. This will be completed onsite at Blue Goat or your facility.

At the end of Evolution 2, we will generate a Letter of Attestation that summarizes the medical device's scope, findings, and overall risk rating. The Letter of Attestation is intended to be shared with clients, auditors, regulators, etc.

What is the goal of a penetration test against a medical device?

Blue Goat understands the importance of securing wired or wireless medical devices and protecting your business from cybercriminals. We assess the cybersecurity posture of your devices to identify vulnerabilities and weaknesses in their networks and infrastructure. By conducting a thorough penetration test, we help protect patients and reduce organizational risk.

During the penetration test, our team evaluates the security defenses of your medical devices and looks for possible entry points for cyberattacks. We examine hardware, software, peripherals, and all other input/output systems. Our experts fuzz, analyze, and test each area for flaws that could compromise patient care or device integrity.

We pay particular attention to common vulnerabilities and exposures (CVEs) found in medical devices. We also assess whether kiosked applications can be bypassed to reach the underlying operating system. This often takes hours or days to uncover a chain of flaws that would make that possible.

We also examine the physical aspects of the device. That includes alternate ports such as JTAG, UART, other unprotected ports, additional USB ports, and accessible hard drives.

We also conduct forensics and post-exploitation analysis, detonating payloads, pivoting, and adjusting operating systems to simulate real-world scenarios that could affect patient care. In addition, we reverse engineer proprietary binaries and programs, searching for sensitive keys to validate whether encryption uses statically set or dynamically created keys.

This penetration test gives you a full view of your medical device's security weaknesses. Our findings let us provide detailed recommendations for patching and strengthening defenses, improving patient safety, and reducing organizational risk.

What is AAMI TIR57?

AAMI TIR57 is a technical information report focused on the principles for medical device security-risk management. It's a guideline from the Association for the Advancement of Medical Instrumentation (AAMI), an organization well known for its work in medical devices.

Overview

AAMI TIR57, titled "Principles for medical device security-Risk management," offers a structured approach to managing cybersecurity risks in medical devices. This matters because connected medical devices can be vulnerable to cyber threats. This report provides guidance on implementing security measures throughout a device's lifecycle, from design and development to decommissioning.

The "Why"

The importance of TIR57 lies in its focus on patient safety and data security. As medical devices become more interconnected and software-dependent, they become more exposed to cyber threats. Those threats can affect device functionality and lead to patient harm. TIR57 helps manufacturers and healthcare providers reduce these risks by establishing stronger security practices.

Examples and Case Studies

Let's say a hospital uses networked medical devices like heart rate monitors or insulin pumps. These devices are critical for patient care. If weak security allows them to be hacked, the outcome could range from data breaches to life-threatening events. Applying the principles of AAMI TIR57, such as conducting risk assessments and including cybersecurity in device design, helps prevent those outcomes.

For Blue Goat Cyber, understanding and applying the guidelines in AAMI TIR57 can be a major value proposition. It means you can offer services that align with these standards, assuring clients that their medical device security is being managed effectively. This includes conducting risk assessments, advising on secure device design, and offering ongoing security support.

Connecting the Dots

In your line of work, AAMI TIR57 is more than guidance. It's a framework for protecting the security and safety of medical devices, which is a core part of healthcare cybersecurity. By integrating these principles into your services, you position Blue Goat Cyber as a knowledgeable provider of medical device security.

Understanding and applying AAMI TIR57 can also help when communicating with cybersecurity decision-makers in healthcare. They need people who understand both technical cybersecurity and the specific risks tied to medical devices. That expertise can set you apart.

What is a Cybersecurity Bill of Materials (CBOM)?

A Cybersecurity Bill of Materials (CBOM) is an essential requirement enforced by the FDA from March 29, 2023, onwards for medical devices. It requires medical device manufacturers to provide a comprehensive and accurate list of software and hardware components used in their devices, including any third-party software and open source components. This list, known as the CBOM, serves as a self-attestation by manufacturers, indicating the accuracy and completeness of the components used in their medical devices. One critical aspect of the CBOM is the inclusion of a Software Bill of Materials (SBOM), which ensures complete transparency regarding software components used in medical devices. Given the critical nature of medical devices and the cybersecurity risks involved, having a comprehensive and accurate SBOM is especially important for maintaining device security and integrity.

How can Blue Goat help in generating accurate SBOMs?

See also: Differences in the IoT and the IoMT, The Dangers of Pacemaker Hacks, and Medical Device Cybersecurity with Interconnected Devices.

Blue Goat has a long-standing record of providing reliable and precise Software Bill of Materials (SBOMs) for its clients for over ten years. We have developed sophisticated tools that enable us to identify components, even at the snippet level, accurately. With our advanced string search algorithms, we can effectively detect all third-party and commercial components. Additionally, Blue Goat offers a comprehensive SBOM-as-a-service solution, which ensures that clients receive complete and accurate SBOMs in standard formats such as SPDX and CDX, which comply with the FDA's requirements. Moreover, Blue Goat can validate internally generated SBOMs or those created by their software supply chain partners, guaranteeing alignment with FDA regulations. By using our expertise and tools, Blue Goat can play a key role in helping organizations generate reliable and accurate SBOMs.

What's the difference in a CBOM and SBOM?

The terms "Cybersecurity Bill of Materials" (CBOM) and "Software Bill of Materials" (SBOM) are related concepts in cybersecurity and software management, often used to improve transparency and security of software products and systems, including medical devices. The main distinction is their scope and focus:

1. Software Bill of Materials (SBOM): An SBOM is a detailed list that provides an inventory of all components, libraries, and modules that make up a piece of software, including both open-source and proprietary elements. The primary purpose of an SBOM is to give users (which can include end-users, developers, and security professionals) a clear understanding of what software is running in their environment. This transparency is crucial for vulnerability management, license management, and security analysis, enabling users to identify potential security risks, comply with licensing requirements, and perform effective patch management.

2. Cybersecurity Bill of Materials (CBOM): A CBOM extends the concept of an SBOM by including not just software components but also hardware components, network dependencies, and any other elements critical to understanding the cybersecurity posture of a device or system. The CBOM is particularly relevant in contexts where the security of the entire ecosystem, including physical components and network interactions, is critical. For example, understanding the full spectrum of components and dependencies in medical devices or industrial control systems is essential for assessing vulnerabilities, potential attack vectors, and overall system security.

In essence, while an SBOM is specifically focused on software components, a CBOM provides a broader view that covers all elements relevant to cybersecurity. Both are tools meant to improve the security and manageability of software and systems, but they do so from different angles. The adoption of SBOMs and CBOMs is encouraged by various cybersecurity frameworks and standards to promote transparency and support better risk management.

What is the significance of SBOMs and SPDX in the present and future?

March 29, 2023, marked a significant milestone as the FDA began enforcing cybersecurity requirements for medical devices, urging manufacturers to comply with a Cybersecurity Bill of Materials (CBOM). A crucial element of the CBOM is the inclusion of a Software Bill of Materials (SBOM), which outlines the comprehensive list of software and hardware components utilized within medical devices. This includes not only internally developed software but also third-party software and open-source components.

The significance of SBOMs lies in their ability to improve transparency and accountability in the medical device supply chain. By requiring manufacturers to self-attest to the accuracy of their SBOMs, regulators can gain a more complete view of the components used in these devices. That supports better assessment and management of potential security vulnerabilities.

One of the recognized standards for SBOMs is the Software Package Data Exchange (SPDX) format. SPDX provides a consistent and standardized way to document and share SBOMs, enabling efficient communication between manufacturers, regulators, healthcare providers, and consumers. This common format supports interoperability and simplifies evaluation by making comparison and analysis easier.

The significance of SBOMs and SPDX now and going forward is their ability to improve cybersecurity practices and transparency across industries, not just in healthcare. As highlighted by the National Telecommunications and Information Administration (NTIA), the implementation of SBOMs should extend beyond medical devices and become common in other sectors as well. That reflects growing recognition that organizations need to understand and manage the software components in all connected systems.

With regulatory enforcement of SBOMs, companies across industries are working to create compliant SBOMs, and some are using third-party providers that specialize in generating accurate and complete SBOMs. These providers, like Synopsys, offer sophisticated tools and solutions that can precisely identify software components used, including third-party and commercial components. They can also ensure that generated SBOMs align with the requirements set by regulators such as the FDA.

What are the additional elements required by the FDA for an SBOM?

The FDA has established additional requirements for a Software Bill of Materials (SBOM) for medical devices. In addition to the minimum elements defined by the National Telecommunications and Information Administration (NTIA), the FDA requires specific additional information. These elements include the support level, support end date, and known security vulnerabilities of the software components used in the medical devices.

While open source projects may not have designated support levels or support end dates, these additional elements largely apply to third-party or commercial components integrated into the medical device application. It is important to include complete and accurate SBOMs for medical devices because they improve transparency and support cybersecurity efforts.

How can Blue Goat Cyber help ensure that medical device software complies with required standards and regulations?

Blue Goat understands the need for compliance in medical device software. Our team has experience with the security process and can help protect your organization from costly and dangerous hacks. With years of experience across different types of testing, we are equipped to address the requirements of your specific device.

We also take compliance seriously. Our team will guide you through the regulatory environment, including the guidelines set by the FDA. We understand the importance of timely product releases, and our expertise helps you move through the steps required to meet standards and regulations.

With Blue Goat on your side, your medical device software can meet the required compliance standards, giving you confidence in the safety and effectiveness of your product.

What tools does Blue Goat use for testing software for medical devices?

Blue Goat Cyber uses a combination of Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) for medical device software testing. SAST involves analyzing the source code to identify vulnerabilities, while DAST tests the running application to find security issues. Both methods are critical for ensuring the security of medical devices, which handle sensitive data and are subject to strict FDA regulations and HIPAA guidelines. Blue Goat Cyber's approach addresses unique concerns related to medical devices, such as compliance with evolving security standards and the protection of critical patient information.

In addition to SAST and DAST, Blue Goat Cyber also incorporates penetration testing and vulnerability assessment tools for comprehensive medical device software testing. Penetration testing tools simulate real-world cyberattacks to identify potential security breaches, while vulnerability testing tools systematically scan for known vulnerabilities. Together, these methods provide a solid framework for ensuring the security and compliance of medical devices, addressing unique challenges such as critical functionality, data sensitivity, and regulatory standards like FDA clearance and HIPAA compliance.

What is some background on medical device vulnerabilities?

Over the past few years, the Internet of Things (IoT), coupled with the ubiquitous nature of Information Technology, has resulted in an expanding attack surface where rapid solution development and added functionality routinely prevail over security. For example, attackers once disrupted most U.S. internet activity using 61 default IoT usernames and passwords. Consumers failed to change them before activating their devices, effectively turning our gadgets into culprits responsible for one of the largest Distributed Denial of Service (DDoS) in the world’s history.

The healthcare industry is rapidly adopting IoT devices, often called the Internet of Medical Things (IoMT), to improve patient safety and treatment delivery. From medication administration to remote sensor monitoring, embedded medical devices are improving quality of care and increasing interaction with providers. But the lack of security in product design remains a major concern and is likely to lead to malicious action with serious consequences.

The consequences became clear in 2017 as researchers were able to acquire equipment (from $15 - $3,000) and intercept the radio frequencies from cardiac devices. With this capability, they could reprogram the devices to modify the patient’s heartbeat and drain the internal battery. As a result, the FDA recalled almost 500,000 pacemakers and enforced in-person firmware updates. Researchers have also demonstrated similar capabilities on infusion pumps and MRI systems.

Non-networked medical devices may be operating at a higher level of risk. Ease of access and the availability of RFID cloners contribute to a relatively weak physical security posture. In 2018, researchers demonstrated the capability to emulate and alter a patient’s vital signs in real time using an electrocardiogram simulator they found on eBay for $100.

In late 2018, the Department of Health and Human Services Office of the Inspector General (IG) critiqued FDA procedures in assessing post-market cybersecurity risk to medical devices. To support the FDA's core mission “to ensure there is a reasonable assurance that medical devices legally marketed in the United States are safe and effective for their intended uses,” they outlined ongoing efforts to improve medical device security.

According to the FDA, “Healthcare Delivery Organizations (HDOs) are responsible for implementing devices on their networks and may need to patch or change devices and/or supporting infrastructure to reduce security risks. Recognizing that changes require a risk assessment, the FDA recommends working closely with medical device manufacturers to communicate necessary changes.”

Blue Goat can help HDOs transfer that risk by evaluating the cybersecurity posture on your wired or wireless medical devices.

Contact us today and inquire about our full-range penetration testing.

We can significantly increase your patient’s safety while reducing your organization’s risk.

What are some reasons for the lack of security in many medical devices?

The lack of security in many medical devices can be attributed to several key factors. One significant factor is the increased scrutiny over the vulnerabilities of these devices, which ultimately forced regulators like the FDA to reassess their cybersecurity requirements. A report by the FBI revealed that 53% of digital medical devices and internet-connected products had critical vulnerabilities, exposing patients and medical providers to various security risks. These vulnerabilities were often found in unpatched and outdated devices, which served as the weak link in the cybersecurity chain. Moreover, research suggests that 88% of healthcare cyberattacks involved an IoMT (internet of medical things) device, further showing the need for stronger security measures.

Inadequate security controls in medical devices have long been a serious issue. Many of these devices have been designed with a primary focus on medical function, with security added later, if at all. These "bolted on" controls have proven inadequate, leaving weaknesses that attackers can exploit. In the past, the lack of mandatory requirements and accountability also contributed to weak security practices across the industry. Recent changes have forced a shift in mindset. New regulations and the potential for costly fines for non-compliance have made it clear that ignoring security is no longer acceptable.

What is the purpose of the new cybersecurity regulations implemented by the FDA?

The FDA's new cybersecurity regulations have been put in place to help ensure the security of medical devices. FDA Section 524B (c) defines a device that falls within the scope of these requirements. According to this section, a device is considered to be within the regulations if it includes software that is validated, installed, or authorized by the sponsor of the device or within it. Additionally, the device must be able to connect to the internet and possess technological characteristics that have been validated, installed, or authorized by the sponsor. This definition highlights the potential vulnerability of these devices to cyber threats. The purpose of these regulations is to address these vulnerabilities and establish a higher level of accountability and responsibility among medical device manufacturers. By mandating compliance and introducing potentially costly fines for non-compliance, the FDA aims to ensure that these regulations have a tangible and meaningful impact on the security of medical devices. The focus on accountability marks a shift from the previous voluntary compliance approach and makes clear that lax cybersecurity is no longer acceptable in the medical device industry.

What testing needs can Blue Goat Cyber cover?

Blue Goat Cyber can cover a wide range of testing needs. Our expertise includes penetration testing, network penetration testing, web application penetration testing, API penetration testing, HIPAA penetration testing, SOC 2 penetration testing, PCI penetration testing, application penetration testing, internal penetration testing, black box penetration testing, gray box penetration testing, white box penetration testing, and mobile application penetration testing.

We also offer specialized services for the testing needs of medical device software. Our healthcare testing professionals verify medical device software requirements and conduct testing at the API, integration, and system levels. With a focus on security, we work to ensure that software architecture can withstand vulnerabilities.

To further improve the reliability and security of medical device software, our team performs software code review and code analysis. We also conduct user acceptance testing to ensure the software meets the usability requirements of healthcare professionals and end users.

Our compliance experts, including FDA and HIPAA specialists, understand the regulatory environment. They work with clients to ensure medical device software meets required standards and regulations. With detailed reporting and comprehensive test documentation aligned with ISO 13485 and ISO/IEC/IEEE 29119-3:2021, we provide transparency into our testing activities.

In addition to healthcare and medical device software testing, we offer medical device cybersecurity, cyber threat awareness training, enterprise cybersecurity audit, static application security testing (SAST), dynamic application security testing (DAST), vulnerability assessment services, CISO-as-a-Service, physical security assessment, phishing services, and HIPAA security risk analysis (HIPAA SRA).

At Blue Goat Cyber, we focus on delivering comprehensive and reliable testing solutions so software and systems are secure, compliant, and ready for use.

How can Blue Goat help organizations protect their assets and networks and produce safer medical devices?

Blue Goat offers solutions to help organizations protect assets and networks while producing safer medical devices. Organizations that work with Blue Goat can access services and expertise to build a strong security testing program.

Through our experience in cybersecurity, Blue Goat can assess current security measures, identify vulnerabilities and risks in network infrastructure, and recommend practical ways to strengthen the overall security posture. By implementing these measures, organizations can better protect assets and networks from cyber threats.

Blue Goat also provides specialized guidance to the healthcare industry to support the production of safer medical devices. We understand the security challenges medical device manufacturers face and can provide tailored solutions to reduce those risks. Our expertise in medical device security can help organizations meet FDA regulatory compliance requirements and industry best practices, reducing the likelihood of device vulnerabilities and data breaches.

What is the FDA's new requirement for connected medical devices?

The FDA has introduced a new requirement for connected medical devices, which went into effect on March 29, 2023. This requirement focuses on cybersecurity and aims to improve the safety and security of these devices. One component of this requirement is the implementation of a Cybersecurity Bill of Materials (CBOM).

Under the CBOM, manufacturers of medical devices need to attest to the accuracy of a comprehensive list of software and hardware components used in their devices. This list should include components developed by the manufacturer and any third-party software and open-source components incorporated into the device.

Specifically, the FDA emphasizes the significance of a Software Bill of Materials (SBOM) within the CBOM framework. An SBOM is essential for connected medical devices because it provides a complete and accurate inventory of all software components used. It allows for better tracking of potential vulnerabilities and supports efficient response and mitigation for possible cybersecurity incidents.

By enforcing this new requirement, the FDA aims to ensure that manufacturers prioritize cybersecurity in the development and maintenance of connected medical devices. Ultimately, this initiative seeks to improve the overall safety and security of these devices for healthcare professionals and patients.

How can cybersecurity vulnerabilities in medical devices lead to patient data breaches?

Patient Monitors: Devices monitoring vital signs like heart rate and blood pressure are susceptible to data interception and manipulation, posing a significant risk to patient data security. Attackers can exploit these vulnerabilities to intercept and manipulate the data being collected. That manipulation can lead to misdiagnosis or delayed treatment, endangering patient safety.

MRI Machines: MRI machines play a critical role in diagnostic imaging. However, they are not immune to cybersecurity threats. Cyberattacks targeting these machines can disrupt their operation, potentially leading to incorrect imaging data or complete operational failure. Such disruptions can affect diagnostic accuracy and treatment plans.

Radiation Therapy Systems: The potential hacking of radiation therapy systems poses a significant threat to patient safety. These systems are used in cancer treatment, and unauthorized access to their controls can result in incorrect radiation doses. That can lead either to insufficient treatment or dangerously high doses.

Diagnostic and Imaging Equipment: Sophisticated medical equipment like CT scanners and ultrasound machines are also exposed to cyber threats. If these devices are compromised, they can provide false diagnostic information, leading to incorrect treatment decisions. Manipulated diagnostic data can delay appropriate treatment or lead to unnecessary procedures.

Surgical Robots: Surgical robots have changed minimally invasive surgeries, but their reliance on precise controls makes them vulnerable to cyberattacks. Unauthorized access or manipulation can result in loss of control or altered movements during surgery. Such interference can lead to surgical errors and patient harm.

Defibrillators: External defibrillators are critical life-saving devices used in emergencies. But they are not immune to cybersecurity vulnerabilities. In the event of a cyberattack, these defibrillators can be hacked to disrupt lifesaving shocks or drain their batteries. That kind of interference can make the devices useless during critical moments.

Hospital Networking Equipment: While not directly involved in patient care, hospital networks are essential to the operation of connected medical devices. A breach in network security can cause widespread problems, including device dysfunction and loss of critical patient data. The interconnected nature of healthcare systems magnifies the impact of a cyberattack on networking equipment.

These vulnerabilities show why healthcare needs stronger cybersecurity measures. Up-to-date software, encryption protocols, and strong password security are necessary to protect patient data and support the safe operation of medical devices.

What are the consequences of cyberattacks on medical devices?

The consequences of cyberattacks on medical devices are serious and can significantly affect patient safety and healthcare institutions. Direct interference with device operation can lead to incorrect treatment and severe health risks. These breaches not only create immediate danger but also damage confidence in the reliability and safety of medical devices and healthcare institutions.

Recovering from a cyberattack can be costly and time-consuming. It often involves device recalls, software upgrades, and potential legal consequences. These steps are necessary to address the exploited weaknesses and prevent additional breaches. Healthcare institutions need strong cybersecurity measures to safeguard networked medical devices and protect patient health.

The possibility that attackers could gain remote control of medical devices is especially concerning. This unauthorized access allows them to manipulate device settings, administer incorrect medication doses, or disrupt life-support functions. Such actions can be life-threatening and make the need for stronger cybersecurity clear.

The medical profession needs to treat the security and safety of networked medical devices as a priority. Steps must be taken to reduce the risk of cyberattacks, protect device integrity, and maintain patient trust in healthcare institutions.

What are networked medical devices and why is cybersecurity important for them?

Networked medical devices are interconnected devices used in healthcare settings that rely on wireless technologies. These devices play an important role in patient care, including insulin pumps, pacemakers, infusion pumps, patient monitors, MRI machines, and more. They let doctors and healthcare professionals remotely monitor and manage patients, supporting efficient and minimally invasive care.

However, the growing interconnectedness of these devices has created cybersecurity concerns that cannot be ignored. When networked medical devices are compromised, they become vulnerable to malicious attacks. That creates a major patient safety risk and can result in severe harm or death. The need for stronger cybersecurity in healthcare technology has been reinforced by several high-profile cases of medical device hacking.

For instance, insulin pumps have been manipulated remotely, exposing patients to the risk of insulin overdose. Pacemakers, which are essential for regulating heart rhythms, have had vulnerabilities that could allow attackers to alter heart rhythms or deplete the battery, creating life-threatening situations. The WannaCry ransomware attack on the UK's National Health Service showed how cyberattacks on hospital networks can indirectly affect patient care and safety.

These vulnerabilities show the need for stronger security protocols, regular software updates, and vigilant monitoring. By implementing these measures, healthcare providers can protect patient safety and support the reliability of these essential networked medical devices.

What recommendations are given to prevent medjacking and secure networked devices?

To prevent medjacking and ensure the security of networked devices, the following recommendations are provided:

1. Promptly address existing devices: Take immediate action to remediate any potential infections on your networked devices.

2. Swiftly implement software/hardware fixes: Develop a strategic plan to efficiently integrate and deploy the necessary updates and fixes provided by medical device manufacturers.

3. Seek expert consultation: Engage competent HIPAA consultants to evaluate and assess your compliance program, providing on-site guidance and expertise. If needed, request a quote for a thorough HIPAA audit.

4. Prioritize cybersecurity-minded vendors: Evaluate medical device vendors based on their commitment to cybersecurity. Choose vendors that allow you to modify passwords, offer regular updates, and are willing to conduct quarterly reviews with you.

5. Manage device access: Implement strict access control measures, particularly through USB ports. Consider utilizing one-way memory sticks to prevent the spread of infections among similar devices.

6. Establish secure network zones: Isolate devices within dedicated, secure network zones. Protect them further by implementing an internal firewall that only permits access to specific services and authorized IP addresses.

7. Address end-of-life for medical devices: Regularly assess the efficacy and longevity of your medical devices. Dispose of devices that are no longer supported by manufacturers or are unable to handle malware effectively. Prior to disposal, ensure the secure wiping or destruction of any patient data stored on the devices.

By following these recommendations, you can significantly improve prevention of medjacking incidents and strengthen the overall security of your networked devices.

Why don't traditional cyber defense tools work with medical devices?

Traditional cyber defense tools are not compatible with network-connected medical devices for several reasons. First, these devices often lack the infrastructure needed to support the installation and operation of security tools. Unlike standard computers or mobile devices, medical devices have limited processing power, memory, and storage capacity. That makes it impractical, if not impossible, to run resource-intensive security software on them.

Applying software modifications to these devices could also be seen as tampering and may affect compliance with regulations set by the FDA. The FDA has emphasized the importance of manufacturers implementing adequate security measures, but restrictions on modifying devices make post-production security improvements difficult.

Traditional security tools are also typically built for more conventional systems and networks. They are often not designed or adapted for the specific vulnerabilities and technical constraints of medical devices. As a result, they may not effectively identify or mitigate threats targeting these systems.

Given the critical nature of medical devices and the risks posed by cybersecurity breaches, manufacturers need to integrate proper security tools into the design and production of these devices from the start. That helps ensure the devices are secure and comply with FDA regulations.

Who is responsible for maintaining security within medical devices?

Maintaining security within medical devices is the responsibility of manufacturers. The FDA emphasizes that manufacturers are required to stay diligent in identifying and addressing risks and hazards associated with their devices, including those related to cybersecurity. However, it is noted that not all manufacturers take this responsibility seriously.

What types of medical devices are at the highest risk of being hacked?

The types of medical devices that are most vulnerable to hacking are stationary devices. While it is unsettling to consider the possibility of internally embedded medical devices being hacked and tampered with, it is important to note that the primary motivation for hackers is financial gain rather than terrorism. These cybercriminals primarily target stationary devices because they present the highest potential for stealing valuable patient data in large quantities.

What is medjacking and how does it pose a threat to healthcare organizations?

Medjacking, also known as medical device hijacking, is a serious cybersecurity issue that puts healthcare organizations at risk. It involves hackers compromising networked medical devices, including consumer health monitoring devices, wearables, embedded devices, and stationary devices, all of which are connected to the internet.

One of the primary reasons medjacking is a threat is the valuable patient health data these devices contain. Stationary devices like medical x-ray scanners and chemotherapy dispensing stations are particularly vulnerable because they hold sensitive information that cybercriminals can exploit. Medical data carries a higher value on the black market than credit card data, making these devices attractive targets.

A major factor behind these vulnerabilities is that manufacturers have often failed to prioritize security. These devices frequently lack strong built-in security measures, making them easier targets. The limited use of cyber defense tools with medical devices makes the problem worse.

The government has also not always taken strong action against manufacturers or enforced strict security measures to reduce these risks. That lack of regulatory pressure has left healthcare organizations more exposed to medjacking incidents.

Another challenge is the difficulty of patching and fixing vulnerabilities in devices that are constantly in use. Healthcare organizations rely on these devices for critical functions and may face logistical barriers when trying to apply necessary security updates.

The consequences of medjacking can be severe. Healthcare organizations may violate HIPAA regulations, face legal and financial penalties, and suffer data breaches that damage patient confidentiality and trust.

To combat medjacking, healthcare organizations should take proactive steps. This includes remediating infected devices, obtaining fixes and updates from manufacturers, consulting HIPAA experts to ensure compliance, evaluating vendors with a strong cybersecurity focus, managing device access, isolating devices in secure network zones, and properly disposing of outdated devices.

What is medical device software testing?

Medical device software testing is a critical process aimed at ensuring that software embedded within or designed to control medical devices functions accurately, reliably, and in compliance with regulatory standards. This testing verifies the software's adherence to its intended functionality, user interface, integration, and overall performance requirements as dictated by medical device regulations, such as the FDA's 21 CFR Part 11 and the internationally recognized IEC 62304 standard. The objective is multifaceted, encompassing the removal of defects in software architecture and code, ensuring the software meets strict regulatory compliance, and ultimately contributing to the production of world-class, safe medical devices.

Key components of medical device software testing include:

• Functional Testing: This evaluates the software's operational aspects to ensure it performs its intended functions correctly. It involves detailed testing of the software's features and capabilities.

• Device Verification Testing: It verifies that the device as a whole, including its software, meets all specified requirements. This testing ensures that the product is designed correctly and works as expected.

• Security Testing: Given the sensitivity of medical data and the potential impact of cybersecurity threats, testing for security vulnerabilities is essential. It helps in identifying and mitigating potential security risks.

• Interoperability Testing: This ensures that the medical device can operate compatibly and safely with other systems or devices. It's crucial for devices that are part of a larger ecosystem of medical equipment.

• Usability Testing: Focused on the human-device interaction, usability testing ensures that the device can be used efficiently, effectively, and satisfactorily by the intended users.

• Performance Testing: This assesses the software's stability, speed, and scalability under various conditions. It is crucial for ensuring that the software can handle its intended workload without failure.

• Compliance Testing: Ensures the software meets all relevant regulatory and industry standards, focusing on safety, quality, and reliability requirements specific to medical devices.

Medical device software testing follows a rigorous methodology that includes planning, requirement analysis, test case development, execution of tests, and thorough documentation throughout the testing cycle. This methodology is designed to identify and address any defects or anomalies in the software architecture, code, or performance before the device reaches the market, thereby ensuring the safety and efficacy of medical devices. The process involves a combination of automated and manual testing techniques and requires a deep understanding of both the technical and regulatory aspects of medical device development.

What are common medical device vulnerabilities?

Common medical device vulnerabilities encompass a range of issues that can compromise the safety, privacy, and effectiveness of medical devices. These vulnerabilities are often related to software flaws, outdated operating systems, or insecure interfaces, which attackers can exploit to gain unauthorized access, steal sensitive data, or disrupt device functionality. Some of the most prevalent vulnerabilities include:

• Insecure Network Connections: Many medical devices connect to healthcare networks via Wi-Fi or Bluetooth, making them susceptible to eavesdropping or unauthorized access if they are not properly secured.
• Outdated Software and Firmware: Devices running on outdated software or firmware are vulnerable to known exploits that have not been patched. This includes operating systems that are no longer supported by their vendors.
• Weak Authentication and Authorization Controls: Insufficient authentication mechanisms can allow unauthorized users to gain access to medical devices, potentially leading to misuse or the alteration of critical healthcare information.
• Lack of Encryption: Failure to encrypt sensitive data both at rest and in transit can expose patient health information (PHI) and other confidential data to interception and misuse.
• Third-Party Software Components: The use of vulnerable third-party software components can introduce additional risks, as device manufacturers may not always regularly update or patch these components.
• Configuration and Customization Errors: Improper configuration or customization of medical devices can leave them open to attacks. This includes default passwords never changed or security features that are disabled for convenience.
• Physical Security: Physical access to medical devices can also pose a threat, especially if devices are not adequately secured within the healthcare facility, allowing for tampering or theft.

Addressing these vulnerabilities requires a comprehensive cybersecurity strategy that includes regular software updates and patches, strong encryption methods, robust authentication and authorization controls, and vigilant monitoring of network connections. Additionally, collaboration between device manufacturers, healthcare providers, and cybersecurity professionals is essential to ensure the ongoing protection of medical devices against emerging threats.

FAQ

What are the primary risks of unsecured IoT medical devices?

Unsecured IoT medical devices pose risks such as patient data breaches, disruption of critical medical services, and potential harm to patients through manipulated device functionality. They can also become part of botnets used for larger cyberattacks.

How does the FDA address cybersecurity for medical devices?

The FDA provides guidance, such as the February 3, 2026 final guidance, which outlines cybersecurity requirements for medical device manufacturers. This guidance emphasizes secure design, risk management, and postmarket activities to maintain device security.

Why are regular software updates important for IoT medical devices?

Regular software updates and patches are crucial because they address newly discovered vulnerabilities and security flaws. Prompt application of these updates helps protect devices from exploitation by cybercriminals and improves overall security.

Can AI and machine learning improve IoT medical device security?

Yes, AI and machine learning can significantly enhance IoT medical device security. They enable real-time threat detection by analyzing network traffic and user behavior, identifying anomalies that may indicate a security breach before it escalates.

What is multi-factor authentication and why is it needed for medical devices?

Multi-factor authentication requires users to provide two or more verification factors to gain access, such as a password and a fingerprint scan. It is essential for medical devices to prevent unauthorized access and protect sensitive patient information.

How often should healthcare organizations audit IoT medical devices?

Healthcare organizations should conduct regular and frequent security audits of their IoT medical devices. These audits help to identify configuration weaknesses, enforce compliance with security policies, and ensure controls remain effective against evolving threats.

About the author

Christian Espinosa, CISSP, Founder, Blue Goat Cyber. Christian leads a team focused exclusively on medical device cybersecurity for FDA premarket submissions and postmarket compliance. Read more about Christian.